release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      network:
        description: Target network
        type: choice
        options: [devnet, mainnet]
        required: true
      priority-fee:
        description: Priority fee (microlamports per CU)
        type: string
        default: '100000'

permissions:
  id-token: write
  contents: read

concurrency:
  group: release-${{ inputs.network }}
  cancel-in-progress: false

env:
  PROGRAM: subscriptions_program
  PROGRAM_ID: De1egAFMkMWZSN5rYXRj9CAdheBamobVNubTsi9avR44
  REPO_URL: https://github.com/solana-program/subscriptions

jobs:
  release:
    name: Release ${{ inputs.network }}
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Load deploy config from Doppler
        uses: dopplerhq/secrets-fetch-action@451892f16195f9ac360e1a5bcbf0b5fd0e957534 # v2.0.0
        with:
          auth-method: oidc
          doppler-identity-id: ${{ vars.DOPPLER_SERVICE_IDENTITY_ID }}
          doppler-project: subscriptions
          doppler-config: ${{ inputs.network == 'mainnet' && 'prd_github' || 'stg_github' }}
          inject-env-vars: true

      - uses: ./.github/actions/setup
        with:
          rust-cache-key: 'release-${{ inputs.network }}'
          solana-version: 'v4.0.0'

      - name: Install solana-verify
        run: cargo install solana-verify --locked

      - name: Materialize deployer keypair
        run: |
          install -m 600 /dev/null /tmp/deployer.json
          printf '%s' "$DEPLOYER_KEYPAIR" > /tmp/deployer.json

      - name: Derive deployer pubkey
        id: deployer
        run: |
          PUBKEY=$(solana-keygen pubkey /tmp/deployer.json)
          echo "pubkey=$PUBKEY" >> "$GITHUB_OUTPUT"

      - name: Configure Solana CLI
        run: solana config set --url "$RPC_URL" --keypair "$HOME/.config/solana/id.json" > /dev/null

      - name: Generate IDL
        run: just generate-idl

      - name: Build verified program
        uses: solana-developers/github-actions/build-verified@eb606791e11d06eb92593dfd3404bf0d4c809121
        with:
          program: ${{ env.PROGRAM }}

      - id: write-buffer
        if: inputs.network == 'devnet'
        name: Write program buffer
        uses: solana-developers/github-actions/write-program-buffer@eb606791e11d06eb92593dfd3404bf0d4c809121
        with:
          program: ${{ env.PROGRAM }}
          program-id: ${{ env.PROGRAM_ID }}
          rpc-url: ${{ env.RPC_URL }}
          keypair: ${{ env.DEPLOYER_KEYPAIR }}
          buffer-authority-address: ${{ steps.deployer.outputs.pubkey }}
          priority-fee: ${{ inputs.priority-fee }}

      # ============================================
      # devnet: direct upgrade by deployer
      # ============================================
      - if: inputs.network == 'devnet'
        name: Upgrade program (devnet)
        uses: solana-developers/github-actions/program-upgrade@eb606791e11d06eb92593dfd3404bf0d4c809121
        with:
          program: ${{ env.PROGRAM }}
          program-id: ${{ env.PROGRAM_ID }}
          buffer: ${{ steps.write-buffer.outputs.buffer }}
          rpc-url: ${{ env.RPC_URL }}
          keypair: ${{ env.DEPLOYER_KEYPAIR }}

      - if: inputs.network == 'devnet'
        name: Upload IDL via program-metadata (devnet)
        uses: solana-developers/github-actions/metadata-upload@eb606791e11d06eb92593dfd3404bf0d4c809121
        with:
          program-id: ${{ env.PROGRAM_ID }}
          rpc-url: ${{ env.RPC_URL }}
          keypair: ${{ env.DEPLOYER_KEYPAIR }}
          idl-path: idl/subscriptions.json
          priority-fees: ${{ inputs.priority-fee }}

      # ============================================
      # mainnet: prepare Squads-owned buffers
      # ============================================
      - if: inputs.network == 'mainnet'
        id: prepare-squads-release
        name: Prepare Squads release buffers (mainnet)
        uses: solana-developers/github-actions/prepare-squads-release@b480a01c45f5670da8e9d76fa03d30d9deb7153d
        with:
          program: ${{ env.PROGRAM }}
          program-id: ${{ env.PROGRAM_ID }}
          rpc-url: ${{ env.RPC_URL }}
          keypair: ${{ env.DEPLOYER_KEYPAIR }}
          squads-vault: ${{ env.SQUADS_VAULT }}
          metadata-path: idl/subscriptions.json
          priority-fee: ${{ inputs.priority-fee }}
          export-verify-pda: 'true'
          repo-url: ${{ env.REPO_URL }}
          commit-hash: ${{ github.sha }}

      - if: inputs.network == 'mainnet'
        name: Confirm mainnet buffer handoff
        run: |
          : "${SQUADS_VAULT:?Set SQUADS_VAULT in Doppler prd_github}"
          echo "Program buffer authority assigned to Squads vault: $SQUADS_VAULT"
          echo "IDL metadata buffer authority assigned to Squads vault: $SQUADS_VAULT"

      - name: Cleanup keypair
        if: always()
        run: rm -f /tmp/deployer.json

      - name: Summary
        run: |
          echo "## Release: ${{ inputs.network }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- Program: \`${{ env.PROGRAM_ID }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- Commit: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
          if [ "${{ inputs.network }}" = "mainnet" ]; then
            echo "- Buffer: \`${{ steps['prepare-squads-release'].outputs.buffer }}\`" >> $GITHUB_STEP_SUMMARY
            echo "- IDL buffer: \`${{ steps['prepare-squads-release'].outputs['metadata-buffer'] }}\`" >> $GITHUB_STEP_SUMMARY
            echo "- Verify PDA transaction exported: \`true\`" >> $GITHUB_STEP_SUMMARY
            echo "- Buffer authority: \`${{ env.SQUADS_VAULT }}\`" >> $GITHUB_STEP_SUMMARY
            echo "- **Action required**: create the Squads upgrade proposal using the listed buffers" >> $GITHUB_STEP_SUMMARY
            echo "- CI keypair role: fee payer and buffer writer only; it does not need Squads membership" >> $GITHUB_STEP_SUMMARY
          else
            echo "- Buffer: \`${{ steps.write-buffer.outputs.buffer }}\`" >> $GITHUB_STEP_SUMMARY
          fi